Method Exchange

server-source-code/internal/auth/oidc/client.go:156–263

Exchange exchanges the authorization code for tokens and fetches UserInfo.

(ctx context.Context, code, codeVerifier, expectedState, expectedNonce string, callbackParams url.Values)

// Exchange exchanges the authorization code for tokens and fetches UserInfo.
func (c *Client) Exchange(ctx context.Context, code, codeVerifier, expectedState, expectedNonce string, callbackParams url.Values) (*UserInfo, error) {
	if err := c.connect(ctx); err != nil {
		return nil, err
	}
	if code == "" {
		return nil, errors.New("oidc: missing code parameter")
	}
	if expectedState == "" {
		return nil, errors.New("oidc: missing state parameter")
	}

	state := callbackParams.Get("state")
	if state != expectedState {
		return nil, errors.New("oidc: state mismatch")
	}

	opts := []oauth2.AuthCodeOption{
		oauth2.VerifierOption(codeVerifier),
	}

	token, err := c.oauth2.Exchange(ctx, code, opts...)
	if err != nil {
		return nil, fmt.Errorf("oidc: token exchange: %w", err)
	}

	rawIDToken, ok := token.Extra("id_token").(string)
	if !ok || rawIDToken == "" {
		return nil, errors.New("oidc: no id_token in response")
	}

	idToken, err := c.verifier.Verify(ctx, rawIDToken)
	if err != nil {
		return nil, fmt.Errorf("oidc: verify id_token: %w", err)
	}

	if idToken.Subject == "" {
		return nil, errors.New("oidc: id_token missing sub claim")
	}

	if expectedNonce != "" {
		if idToken.Nonce != expectedNonce {
			return nil, errors.New("oidc: nonce mismatch")
		}
	}

	userInfo := &UserInfo{
		Sub:     idToken.Subject,
		IDToken: rawIDToken,
	}

	userInfoClaims := make(map[string]interface{})
	if token.AccessToken != "" {
		oidcUserInfo, err := c.provider.UserInfo(ctx, oauth2.StaticTokenSource(token))
		if err != nil {
			if !isMicrosoftIdentityIssuer(c.cfg.IssuerURL) {
				return nil, fmt.Errorf("oidc: fetch userinfo: %w", err)
			}
		} else {